CVE-2026-7908 is a critical use-after-free vulnerability in the Fullscreen feature of Google Chrome prior to version 148.0.7778.96. Exploitation could allow remote attackers to perform a sandbox escape by leveraging a crafted HTML page, potentially leading to full compromise of the browser environment. The vulnerability has a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting its critical nature and ease of remote exploitation with user interaction. The issue is fixed in Chrome version 148.0.7778.96 as per Google's stable channel update announcement.

Successful exploitation of this vulnerability could allow an attacker to escape the Chrome sandbox, leading to high impact on confidentiality, integrity, and availability of the affected system. This could enable execution of arbitrary code outside the browser sandbox, potentially compromising the host system. No known exploits are reported in the wild at this time.

Google has released an official stable channel update for Chrome version 148.0.7778.96 that addresses this vulnerability. Users and administrators should update affected Chrome installations to this version or later to mitigate the risk. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No additional mitigation steps are indicated by the vendor.